I think that for a newbie, hardware wallet is the best. Buy a trezor from their official website. Note down the seed and create a passphrase. 99.9999% safe.

Another options, which you will have a lot more trouble and will be at risk if you do something wrong:

Use an old laptop and remove the network card. Install electrum and sign transactions there. Just scan QR codes of signed transaction to broadcast the transactions in a phone/computer with internet access. Never insert a pendrive in this machine. Looks too much trouble for most people.

This important and it applies to all other hardware products. It's hard to trust a reseller these days after the Ledger reseller tampered the chips of their product.

While there's still another risk for this but I think it's an isolated case, and that's about the courier/logistics where they can replace the product on their warehouse upon shipment.

Although I don't think that there's a lot of those cases and it's still safer to order directly to the official manufacturer website of trezor or any other hardware wallets.

My opinion on this is it will only be safe if you're the only one knows where you'll place it.

Otherwise, if someone finds it where you're hiding it and then have an idea of what it is you know what's coming next.

This is the same as putting the 2FA on the same phone where the wallet is installed.

Disconnecting the network cable on a computer that was online and thinking it makes it secure to create a wallet on!

You'll need a clean system that is air-gapped to create a secure wallet. A system that was already connected to the internet should be considered already-compromised.

It is not that complicated to verify the addresses. The input (addresses) as well as change address belong to your own wallet and the wallet software should highlight them already to make it easier to visually detect them. The other address(es) can be verified by checking first, middle and last handful of characters.

The most important thing is to learn the correct way of doing each of these. I already pointed out the fallacy of believing your previously online system is safe just by removing the network cable. Another thing is about multi-sigs, the common mistake is that people create all keys on the same machine and store all of them in the same place and use them in the same place too and think they are "more" secure because of that. That is wrong. The keys need to be created, stored and used completely separately to provide that additional security.

I see no problem with that. Also , keep a bakcup of both in another location.
Passphrase is important  to add randomness , in a situation like the coldcard incident


No not in this case. Multisig is important when 2 parties need to confirm the transaction,  like you and your wife or you and your partner.

Too much trouble to create a multisig to one person control all keys

Let me talk more about backing up your seed: ensure that you are accurate in copying your seed phrase and also translate it to the appropriate material or storage that is durable and will not, by any chance, be great to miss any of those words over time. The moment you make a mistake in writing them down, it could place a future implication when trying to recover your wallet from the use of those seed phrase, we must verify and ensure that we copy the right words in the correct order and make use of durable storage for the seeds.

Are you really asking this? Even your seed phrase, if possible you should divide them into separate locations. Moreover, the passphrase is something you created yourself which is just like your phone password. If I may ask, do you write your phone password somewhere? I think No. So it's not necessary to write down your passphrase because I think you should create something that you'll easily remember and hard for others to guess but you shouldn't create something difficult that you'll have to write it down. It's possible for someone to have access to somewhere you wrote the seed phrase but they can't have access to something in your memory.

Using a hardware wallet with a proper offline seed backup is a good way to start in that aspect of security, but the most important thing to me is making sure nobody can access your private keys or seed phrase and that should even be the main concern of every users not just me. And also in terms of security when it comes to bitcoin I always verify every transaction and receiving address before approving anything at all observation first and for someone that’s having a large amount of Bitcoin, multisig can provide extra protection because the funds are not controlled by just one key.

Security of a device, a wallet does not come from a single factor in our practice but actually comes from multiple factors. Practice for having good security is very complex but if we are ready to read, learn, change our security mindset and practice, we can improve our practice and get better security. Not best or perfect security but still far better than if we're not knowledgeable about necessary practice for security, and careless with our practice.

How to Install Tails OS on USB flash drive for Wallet Purpose.
What to do to avoid phishing sites.
How to keep bitcoin secure.

I usually have different opinion about this because personally I feel both seed phrase and passphrase shouldn’t be stored in the same place since the passphrase is a second layer protection to the seed phrase and having them both on the same place is not a great idea because imagine the back up gets exposed and someone gets the steel sheet then they will be able recover that wallet.


One thing about multi sig is its best with a different devices so even if you wish to set it up yourself you would need to have differen device for each signer and then all back for each signer should be in different locations, this complication is why for an individual the best is single sig with passphrase added as extra security

The most common mistake when setting up a cold storage wallet is to not actually make it airgapped. Many people believe that formatting an old laptop with a fresh linux distro and using it just as a wallet comes with equal security as a signing device that never connects to any network.

The second most common mistake is not looking at the transactions you sign properly, or not verifying the signatures of the bitcoin programs you install.